hoangsonww/RAG-LangChain-AI-System

Feature: Multi-Workspace Tenancy with RBAC and Isolated Knowledge Bases

Open

#20 opened on Mar 8, 2026

View on GitHub
 (0 comments) (0 reactions) (1 assignee)Jupyter Notebook (13 forks)auto 404
bugdocumentationenhancementgood first issuehelp wantedquestion

Repository metrics

Stars
 (46 stars)
PR merge metrics
 (PR metrics pending)

Description

Summary

Add first-class multi-workspace support so one deployment can safely serve multiple portfolio teams with strict data isolation, RBAC, and workspace-scoped retrieval/session state.

Why this matters

The current platform behaves like a single-tenant system. For real adoption across multiple investor teams, we need tenant boundaries so data, sessions, and retrieval context never leak between workspaces.

Scope

  • Workspace model (workspace, membership, role).
  • Role-based access control (owner, editor, viewer) for API and frontend actions.
  • Workspace-scoped data isolation for:
    • chat sessions
    • vector indexes / collections
    • cached responses
    • ingestion jobs
  • Workspace context propagation through request lifecycle and backend tool calls.
  • Audit trail for high-risk actions (ingest, delete, reindex, export).

Non-goals

  • Full enterprise SSO implementation in this issue (can be follow-up).
  • Billing/plan management.

Proposed implementation

  1. Introduce workspace entities in backend (Mongo) and auth middleware that resolves workspace_id + role.
  2. Enforce workspace filters in all backend routes and RAG service storage layers.
  3. Partition vector stores by workspace namespace/collection.
  4. Add workspace switcher in frontend and block cross-workspace session loading.
  5. Add request-level policy checks and structured audit logs.

Acceptance criteria

  • Users can belong to multiple workspaces and switch context in UI.
  • Every chat, retrieval, and ingestion request is bound to one workspace.
  • Cross-workspace reads/writes are blocked at API and storage layers.
  • Role restrictions are enforced for ingestion, deletion, and admin operations.
  • Automated tests cover authorization matrix and isolation guarantees.
  • Audit events are emitted with actor, workspace, action, and target.

Dependencies / sequencing

  • Should align with API modularization work but is not blocked on full FastAPI migration.

Labels

enhancement, security, backend, frontend

Contributor guide

Research direction
Study the existing backend models (user, session, chat), understand how workspace isolation is currently missing, then design workspace and membership models. Look at the auth middleware to see where to inject workspace context. For frontend, examine the session management to add workspace switcher. For vector store isolation, review how Chroma/FAISS collections are created and queried.
Tech stack
pythonjavascript
Domain
full stack
Issue type
Feature
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
4
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
Over 1 week
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
Active
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
Clear
Prerequisites
Git
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
20